CSP is a safety net behind your normal defenses. If someone finds a way to inject a script into your page, a strict policy can make the browser refuse to run it because it does not come from an allowed source or carry the right nonce.
Most AI-built apps ship without one, and those that add one often weaken it until it does nothing, for example by allowing unsafe inline scripts and eval to make a library work. A policy that allows everything protects nothing.
Start in report-only mode to see what would break without blocking anything, then tighten. Prefer nonces or hashes over allowing all inline scripts, list only the third-party hosts you actually use, and send the header on every response from your server or host configuration.
Content-Security-Policy: default-src 'self'; script-src 'self'; img-src 'self' data:; frame-ancestors 'none'